Security Alerts

Microsoft Security Bulletin: October 11

Qualys® Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against vulnerabilities that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit our blog to see how to prioritize remediation.

Threat:

This security update resolves a publicly disclosed vulnerability in Windows Media Center. The security update addresses the vulnerability by correcting the manner in which Windows Media Center loads external libraries.

This security update is rated Important for all supported editions of Windows Vista and Windows 7; and Windows Media Center TV Pack for Windows Vista.

Impact:

The vulnerability could allow remote code execution if an attacker convinces a user to open a legitimate file that is located in the same network directory as a specially crafted dynamic link library (DLL) file. Then, while opening the legitimate file, Windows Media Center could attempt to load the DLL file and execute any code it contained.

For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a legitimate file.

Solution:

Patch:Following are links for downloading patches to fix the vulnerabilities:

Threat:

The security update addresses the vulnerabilities by correcting the way that the Windows kernel-mode drivers validate input passed from user mode, handle the TrueType font type, allocate the proper buffer size before writing to memory, and manage kernel-mode driver objects.

This security update is rated Important for all supported releases of Microsoft Windows.

Impact:

The most severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted font file (such as a .fon file) in a network share, a UNC or WebDAV location, or an e-mail attachment. For a remote attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open the specially crafted font file, or open the file as an e-mail attachment.

Solution:

Patch:Following are links for downloading patches to fix the vulnerabilities:

Threat:

An HTTP response splitting vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1895)

An XSS vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1896)

Microsoft Forefront Unified Access Gateway (UAG) applies a signed Java applet that can be leveraged by malicious Web sites to cause remote code execution on any Java-enabled Web browser. (CVE-2011-1969)

A denial of service vulnerability exists in implementations of Microsoft Forefront Unified Access Gateway (UAG). When this occurs, an attacker could leverage the vulnerability to stop the IIS worker process and deny access to Web services on the affected system. (CVE-2011-2012)

Impact:

An attacker who successfully exploits this vulnerability could read content that the attacker is not authorized to read, use the victim's identity to take actions on behalf of the victim, and inject malicious content in the browser of the victim and crash the web server on the affected UAG machine.

Solution:

Patch:Following are links for downloading patches to fix the vulnerabilities:

Threat:

Microsoft Internet Explorer is a Web browser available for Microsoft Windows.

When Internet Explorer attempts to access an object that has been deleted or a dereferenced memory address or a corrupted virtual function table, it may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.

Microsoft has released an update that addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory and the way that Internet Explorer allocates and accesses memory.

This security update is rated Critical for Internet Explorer on Windows clients and Moderate for Internet Explorer on Windows servers.

Impact:

The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploits any of these vulnerabilities could gain the same user rights as the local user.

Solution:

Patch:Following are links for downloading patches to fix the vulnerabilities:

Threat:

Microsoft Host Integration Server is prone to a denial of service vulnerability that is caused due to improper input validation when Host Integration Server processes specially crafted network traffic. (CVE-2011-2008,CVE-2011-2007)

This new vulnerability check is included in Qualys vulnerability signature 1.28.241-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYS:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

Ensure access to TCP ports 135 and 139 are available.

Enable Windows Authentication (specify Authentication Records).

Enable the following Qualys IDs:

90743

90747

90746

90745

90749

90744

100111

90748

If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.

If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Impact:

Successfully exploiting these vulnerabilities might allow an attacker to execute arbitrary code. Other attacks are also possible.

Solution:

Apple iTunes 10.5 has been released to address these issues. The update can be downloaded and installed via Apple Downloads.

Refer to Apple Security Update APPLE-SA-2011-10-11-1 for more information on the vulnerabilities and patching your system.

This new vulnerability check is included in Qualys vulnerability signature 119637. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYS:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.